Distribution overview
How modules work — Execute, DryRun, Validate, HealthCheck. Fan-out concurrency, batch sizing, post-distribution validation, and how distribution failures interact with renewal.
Distribution primitives
The reusable objects every distribution composes from: Path Sets (where files land), Action Sets (what runs after), Module Credentials (auth material), Project Variables (per-environment values), Validation Endpoints (post-deploy TLS fingerprint check), and the Fan-out execution model. Define each once; reuse across dozens of targets and certificates.
Targets & groups
A target is one concrete endpoint of a given module type — an SSH host, a K8s cluster, an F5 BIG-IP management URL, a Vault instance. A target group is a named collection of targets for bulk distribution. Both live under Settings → Distribution.
Fan-out execution
How large distributions are split into parallel batch child jobs: the fan-out threshold, per-target retry with error classification, aggregate status computation, and the dedicated distribution worker lane.
Post-distribution validation
Per-target validation endpoints that verify the deployed certificate is actually being served: TLS fingerprint checks with SNI, configurable retries, SSRF protection, and automatic status downgrade to partial on failure.
Module health checks
What the per-module health check verifies (connectivity + authentication, per target), how to run it from the UI or API, and what a green result does not guarantee.
Rollback
One uniform rollback mechanism: re-deploy a previous retained certificate version through the module's normal deploy path. Eligibility rules, the version picker, the rollback API, auto-rollback with flap guard, retention pinning, and the sticky rolled_back status.
External secret stores
2 items
SSH module
The SSH module copies the certificate + private key + chain to a target host using SCP/SFTP, then runs post-deployment actions (typically systemctl reload nginx or equivalent). It is the most-used distribution module. Rollback re-deploys a previous retained certificate version through the same deploy path.
Kubernetes module
Deploy a certificate as a kubernetes.io/tls Secret in one or more clusters. Works with in-cluster service-account auth (when CertAutoPilot itself runs on Kubernetes) or with inline kubeconfig for external clusters. Multi-cluster is supported via multiple targets.
Microsoft IIS module
Deploys certificates to Windows Server IIS over WinRM: imports the PKCS#12 into the local machine certificate store and updates the site's HTTPS binding(s) — one binding, all matching bindings, or an explicit host-header list. Works with Windows Server 2016+.
Windows (WinRM) module
Deploy any file to any Windows path, then run PowerShell post-deploy scripts. The Windows sibling of the SSH module — same PathSet + ActionSet operator UX, different transport. Distinct from the IIS module, which is dedicated to IIS binding lifecycle.
F5 BIG-IP module
Uploads cert + key + chain to F5 BIG-IP LTM via iControl REST and creates or updates the named SSL profile's certKeyChain. Supports TMOS 13.0+, partition scope, and intermediate-chain handling with fingerprint-based naming to avoid duplicate objects.
NetScaler (Citrix ADC) module
Uploads cert + key to NetScaler ADC over NITRO REST, creates or updates the sslcertkey object in place (existing vserver bindings keep working), chains intermediate certificates with fingerprint-based global names, and skips the update when the certkey already holds the certificate. Newly created certkeys must be bound to vservers manually.
HashiCorp Vault module
Writes certificate + key + chain into a Vault KV secret path (KV v1 or v2, selected per target). Rollback writes a previous retained certificate version back through the same deploy path. Supports Token and AppRole authentication.
Webhook module
Delivers a certificate payload to any HTTP endpoint — the escape hatch for targets that don't fit one of the other modules. You configure the URL, headers, payload template, timeout, and attempt count; the receiving system owns persistence and rollback.
Huawei Cloud module
Creates or updates a certificate object in Huawei Cloud ELB (v3) or WAF (v1), or writes the certificate into a CDN (v2) domain's HTTPS configuration. Uses AK/SK (access key + secret key) authentication; ELB/WAF are regional, CDN is global.
SMTP module
Emails the issued certificate artefact to one or more recipients after every successful renewal. Useful for key-ceremony hand-off, compliance archive mailboxes, and ops DLs that don't have an API integration. Not a notification — the SMTP module ships the certificate bytes themselves (PEM + chain, optionally private key or a passphrase-protected PKCS#12 bundle), the same way SSH ships PEM files to a box.
AWS ACM module
Imports (and on renewal re-imports) the certificate into AWS Certificate Manager. AWS propagates a same-ARN re-import to every attached resource — CloudFront, ALB/ELB, API Gateway — so no CloudFront/ELB API calls are needed.
MerlinCDN module
Uploads a certificate to MerlinCDN and binds it to a CDN distribution's canonical-name (CNAME). MerlinCDN certificates are immutable, so every renewal uploads a fresh certificate and re-binds. Uses a personal access token plus organization/workspace ids.
Microsoft Exchange module
Natively imports a certificate into on-premises Microsoft Exchange Server (2013/2016/2019/SE) over WinRM using the Exchange Management Shell, and enables it for the IIS/SMTP/POP/IMAP services. Every renewal imports a new thumbprint; rollback re-imports and re-enables a previous retained certificate version.
Cloudflare module
Uploads the certificate to a Cloudflare zone as a Custom Certificate (Bring-Your-Own edge cert) and updates it in place on renewal. Requires a Business or Enterprise plan.
Azure Key Vault module
Imports the certificate into an Azure Key Vault as a new version of a KV certificate, so Azure consumers (App Service, Application Gateway, APIM, AKS) pick up the renewal automatically.
cPanel / WHM module
Installs the certificate onto a cPanel/WHM server's domain(s) via cPanel UAPI or WHM API. One target serves many certificates; the install domain list is overridable per distribution.
PAN-OS module
Imports the certificate into a Palo Alto Networks PAN-OS firewall as a named certificate object and commits the change with a partial commit scoped to CertAutoPilot's own API user. Renewals re-import under the same name, so SSL/TLS profile and GlobalProtect bindings are preserved automatically.